Privacy Policy
Privacy Policy
15 October 2026
15 October 2026
1. Introduction
Vandzilah Technology Limited (“Vandzilah Technology”, “VDT”, “we”, “our” or “us”) respects your privacy and is committed to handling personal information responsibly.
This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you visit our website, contact us, request our services, engage with our business or otherwise interact with us.
Our website is:
www.vandzilahtechnology.com
Vandzilah Technology is based in Accra, Ghana, and provides software development, cloud solutions, AI and automation, IoT, creative and digital design, IT consulting, technology operations and related digital services to clients in Ghana and international markets.
We aim to process personal information in accordance with Ghana's Data Protection Act, 2012 (Act 843), and other applicable data-protection laws, including the European Union General Data Protection Regulation (GDPR) where applicable.
Please read this Policy carefully to understand our privacy practices.
2. Who Is Responsible for Your Personal Data?
For personal information collected through our corporate website and ordinary business communications, Vandzilah Technology Limited generally acts as the data controller where it determines the purposes and means of processing.
Data Controller: Vandzilah Technology Limited
Business Address: 10 Nii Kwei, Okang Mensah Street, Adjiringanor, School Junction, Accra, Ghana.
Email: [email protected]
Telephone: +233 20 656 2493 / +233 25 727 2401
For certain client projects, VDT may process personal information on behalf of a client and according to the client's instructions. In those circumstances, the client may be the data controller and VDT may act as a data processor.
The respective roles and responsibilities will depend on the actual processing activity and any applicable contract.
3. Personal Information We Collect
The information we collect depends on how you interact with us.
3.1 Information You Provide Directly
When you submit an enquiry, request a consultation, contact our team or discuss a potential project, we may collect:
Name and professional title, where provided.
Business or personal email address.
Telephone number.
Country and relevant business location.
Company or organisation name and professional role, where provided.
Enquiry category, preferred contact method and message content.
Project requirements, proposed budgets, timelines and related business information.
Information included in correspondence, proposals, support requests and other communications.
Please avoid sending passwords, payment-card details, sensitive personal information or confidential third-party data through a general website contact form unless a suitable, authorised process has been expressly established.
3.2 Technical and Usage Information
When you visit our website, certain information may be collected automatically by our website infrastructure or service providers, depending on the technologies deployed.
This may include:
IP address and general network information.
Browser type and version.
Device type and operating system.
Pages visited, referring pages and interaction timestamps.
Website performance, error logs and diagnostic information.
Cookie identifiers or similar technologies, where enabled.
The information actually collected depends on our hosting configuration, analytics tools, security systems and cookie settings.
3.3 Client, Supplier and Business Partner Information
Where relevant to a business relationship, we may collect professional contact details, company information, contractual records, invoices, transaction records, project correspondence and service-delivery information.
We may also maintain information relating to prospective clients, suppliers, consultants, recruitment applicants and business partners where necessary for legitimate business operations and applicable legal obligations.
3.4 Information Processed Through Client Projects
In delivering software, cloud, automation, IoT or managed IT services, VDT may receive or process information belonging to a client or its users.
The nature of that information depends on the relevant project and may include account details, user records, technical logs, application data or other information specified by the client.
Where VDT processes personal information on behalf of a client, the applicable service agreement and data-processing arrangements should define the permitted purposes, instructions, security requirements, retention periods and responsibilities of each party.
Separate privacy notices may apply to individual products, platforms or applications developed or operated by VDT. This Policy does not automatically replace those product-specific notices.
4. How We Use Personal Information
We may use personal information for the following purposes:
Responding to enquiries: To respond to contact-form submissions, consultation requests, service enquiries and other communications.
Providing services: To prepare proposals, assess project requirements, deliver contracted services, provide technical support and manage client relationships.
Business administration: To manage contracts, invoices, payments, supplier relationships, internal records and operational activities.
Website operation: To maintain, troubleshoot, secure and improve the performance and usability of our website.
Security and fraud prevention: To detect suspicious activity, prevent unauthorised access, investigate misuse and protect our systems and users.
Business communications: To communicate about existing engagements, service changes, project updates and relevant business matters.
Marketing: To send business updates, service announcements or promotional communications where permitted by applicable law and, where required, with your consent.
Legal compliance: To meet applicable legal obligations, respond to lawful requests and establish, exercise or defend legal claims.
Service improvement: To assess general website usage, improve our offerings and understand business needs, using aggregated or appropriately protected information where possible.
We will not use personal information for purposes that are incompatible with the purposes disclosed to you unless we have a lawful basis to do so and provide any additional information or obtain any consent required by law.
5. Legal Bases for Processing
Where the GDPR applies, we process personal information only where a lawful basis is available. Depending on the circumstances, this may include:
Contract: Processing necessary to enter into or perform a contract with you.
Legitimate interests: Processing necessary for legitimate business interests, provided those interests are not overridden by your rights and interests.
Consent: Processing based on your freely given, specific and informed consent, where required.
Legal obligation: Processing necessary to comply with applicable law.
Vital interests or other lawful grounds: Where a relevant legal basis applies in the specific circumstances.
Under Ghanaian law, processing will also be subject to the applicable requirements of the Data Protection Act, 2012 (Act 843), including its principles governing lawful, fair and transparent processing.
Where consent is the applicable basis, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
6. How We Share Personal Information
We do not treat personal information as a commodity for sale.
We may disclose or make personal information available to the following categories of recipients when necessary and lawful:
6.1 Service Providers
These may include website hosting companies, cloud infrastructure providers, email services, customer relationship management systems, IT support providers, security vendors and other technology service providers.
Such providers should receive only the information reasonably necessary to perform their authorised functions and should be subject to appropriate contractual and security requirements where applicable.
6.2 Professional Advisers
We may share relevant information with lawyers, accountants, auditors, insurers and other professional advisers where reasonably necessary for business operations, legal advice, risk management or compliance.
6.3 Clients and Project Partners
Where necessary to deliver an agreed service, we may share relevant information with authorised clients, subcontractors, integration partners or other project participants, subject to applicable agreements and data-protection requirements.
6.4 Authorities and Legal Requests
We may disclose information where required by law, a valid legal process or a competent authority, or where disclosure is otherwise legally permitted to protect rights, safety, property or the security of our systems.
6.5 Corporate Transactions
If VDT undergoes a merger, restructuring, acquisition, financing or transfer of business assets, relevant information may be disclosed as necessary for the transaction, subject to appropriate safeguards and applicable law.
6.6 No Sale of Personal Data
We do not sell personal information to third parties for their independent commercial use.
Where third-party advertising, analytics or similar technologies are deployed, their data practices and any applicable consent requirements will be addressed through the relevant privacy and cookie controls.
7. International Data Transfers
As a Ghana-based technology company serving clients in international markets, VDT may need to transfer or permit access to personal information across national borders when delivering services or using international service providers.
Where such transfers occur, we will assess the applicable legal requirements and implement appropriate safeguards.
Where the GDPR applies, transfers of personal data outside the European Economic Area will be made using a legally recognised transfer mechanism where required, such as an adequacy decision or appropriate contractual safeguards, together with any additional measures necessary in the circumstances.
The locations of relevant service providers, data hosting environments and subprocessors should be identified through our actual operational arrangements and, where appropriate, disclosed to affected clients or individuals.
8. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, subject to applicable legal, contractual and regulatory requirements.
Retention periods depend on the type of information and the reason it was collected.
Examples include:
Enquiries: For the period reasonably required to respond, follow up and maintain relevant business records.
Client and project records: For the duration of the engagement and any additional period required for contractual, operational or legal purposes.
Financial and accounting records: For the period required under applicable accounting, tax and other legal requirements.
Security and technical logs: For a period proportionate to security, troubleshooting and operational needs.
Marketing preferences: Until consent is withdrawn, an objection is received or the information is otherwise no longer needed, subject to lawful recordkeeping requirements.
When personal information is no longer required, we will take appropriate steps to delete, anonymise or securely dispose of it, subject to applicable law and legitimate retention requirements.
Specific retention schedules should be maintained internally for the systems and categories of data that VDT actually uses.
9. Cookies and Similar Technologies
Our website may use cookies, pixels, local storage or similar technologies, depending on the tools and configurations deployed.
These technologies may support:
Essential website functionality and security.
User preferences and website settings.
Website performance and diagnostics.
Analytics and usage measurement.
Marketing or embedded third-party functionality, if enabled.
Where applicable law requires consent before using non-essential cookies or similar technologies, we will obtain that consent before activating the relevant technologies.
Where a consent-management tool is used, you should be able to review and change your preferences in accordance with the applicable requirements.
You may also be able to manage cookies through your browser settings. Disabling certain cookies may affect website functionality.
This section describes the categories of technologies that may be used. VDT should verify its live website configuration and publish a cookie-specific disclosure where necessary before treating this description as a complete inventory.
10. Data Security
We recognise the importance of protecting personal information against unauthorised access, loss, misuse, alteration, disclosure or destruction.
Depending on the processing activity and the risks involved, appropriate safeguards may include:
Access controls and permission management.
Secure authentication and credential management.
Encryption where appropriate.
System monitoring, logging and security updates.
Backups and recovery procedures.
Confidentiality obligations and staff awareness.
Vendor and service-provider security reviews.
Procedures for managing security incidents.
The specific safeguards used will depend on the systems, services and information involved.
No internet transmission, software platform or storage system can be guaranteed to be completely secure. However, we aim to implement safeguards proportionate to the risks and applicable legal requirements.
If a personal-data breach occurs, we will assess the incident and take the notifications and remedial actions required by applicable law.
11. Your Privacy Rights
Depending on your location, the applicable law and the circumstances of processing, you may have rights concerning your personal information.
These may include:
Right to be informed: To receive information about how your personal data is processed.
Right of access: To request access to personal information we hold about you.
Right to rectification: To request correction of inaccurate or incomplete information.
Right to erasure: To request deletion where the applicable legal conditions are met.
Right to restrict processing: To request that certain processing activities be restricted in qualifying circumstances.
Right to object: To object to certain processing, including direct marketing and, where applicable, processing based on legitimate interests.
Right to data portability: Where the GDPR applies and the relevant conditions are met, to receive certain personal information in a structured, commonly used and machine-readable format and transmit it to another controller.
Right to withdraw consent: To withdraw consent where processing relies on consent.
Right to lodge a complaint: To complain to the relevant data-protection authority where you believe your rights have been infringed.
These rights are not absolute and may be subject to legal conditions, exemptions and limitations.
How to Exercise Your Rights
To submit a privacy request, contact us at:
Email: [email protected]
Subject: Privacy Request – [Describe Your Request]
Please provide enough information for us to understand and respond to your request. We may need to verify your identity before disclosing personal information or taking action.
We will respond within the time required by applicable law. If we cannot fulfil a request, we will explain the reason where legally required.
For individuals in Ghana, the Data Protection Commission provides information about data-subject rights and complaint procedures.
12. Direct Marketing and Business Communications
We may use professional contact information to communicate about our services, business opportunities, events, partnerships and relevant technology developments where permitted by law.
Where consent is required, we will obtain it before sending the relevant marketing communications.
You may opt out of marketing emails by using the unsubscribe mechanism where available or contacting us directly.
An opt-out from marketing will not prevent us from sending essential communications concerning an active contract, a service you have requested, security matters or other legitimate non-marketing purposes.
We will respect applicable objections and suppression requirements.
13. Children's Privacy
Our corporate website and general business services are primarily intended for businesses, professionals and other users able to engage with our services lawfully.
We do not knowingly seek to collect children's personal information through the corporate website unless a legitimate purpose and appropriate safeguards have been established.
Where a particular service is intended for children or may collect their information, additional age-appropriate notices, consent arrangements and safeguards will be implemented as required by applicable law.
If you believe a child has provided personal information to us in circumstances that were not appropriate, please contact us so we can assess the matter.
14. Third-Party Websites and Services
Our website may contain links to third-party websites, social media platforms, cloud services, embedded content or other external resources.
We are not responsible for the independent privacy practices of those third parties.
Before submitting personal information to an external service, we encourage you to review its privacy policy and terms.
Where a third-party service is integrated into a VDT project, the applicable project documentation should clarify the relevant data-processing responsibilities.
15. AI, Automation and Emerging Technologies
VDT provides or develops technology solutions that may include AI, automation, data analytics, IoT and intelligent systems.
Where such technologies process personal information, we will assess the applicable legal obligations, the purpose of processing and the risks to individuals.
We aim to apply appropriate safeguards, data minimisation, access controls and human oversight where required by the nature of the service.
We will not assume that publicly available information, client-provided data or information entered into an AI-enabled system is automatically free from privacy or confidentiality obligations.
The processing of sensitive information, automated decision-making or other high-risk activities may require additional notices, contractual provisions, assessments or safeguards.
Specific AI-enabled products may be subject to additional product-level privacy documentation.
16. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our services, systems, data-processing practices or legal obligations.
The updated Policy will be published on our website with a revised “Last Updated” date.
Where a material change requires additional notice or consent, we will take the steps required by applicable law.
We encourage visitors and clients to review this Policy periodically.
17. Contact Us
For questions, concerns or requests relating to this Privacy Policy or the handling of personal information, contact:
Vandzilah Technology Limited
Address: 10 Nii Kwei, Okang Mensah Street, Adjiringanor, School Junction, Accra, Ghana.
Email: [email protected]
Telephone: +233 20 656 2493 / +233 25 727 2401
Website: www.vandzilahtechnology.com
If you believe your personal information has been processed in breach of applicable law, you may also contact the competent data-protection authority in your jurisdiction.
For Ghana, the relevant authority is the Data Protection Commission.
Website: https://dpc.gov.gh/
